[patch -mm] alsa mixer_oss kfree fix

Hi,
Fix possible null pointer kfree.

Signed-off-by: dave young <[email protected]>

mixer_oss.c |    120 +-
1 file changed, 74 insertions(+), 46 deletions(-)

diff -purN linux/sound/core/oss/mixer_oss.c linux.new/sound/core/oss/mixer_oss.c
--- linux/sound/core/oss/mixer_oss.c	2007-06-01 09:00:12.000000000 +0000
+++ linux.new/sound/core/oss/mixer_oss.c	2007-06-01 09:36:10.000000000 +0000
@@ -512,23 +512,27 @@ static void snd_mixer_oss_get_volume1_vo
		return;
	}
	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL)
+		goto out_uinfo;
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL)
-		goto __unalloc;
+	if (uctl == NULL)
+		goto out_uctl;
	if (kctl->info(kctl, uinfo))
-		goto __unalloc;
+		goto out;
	if (kctl->get(kctl, uctl))
-		goto __unalloc;
+		goto out;
	if (uinfo->type == SNDRV_CTL_ELEM_TYPE_BOOLEAN &&
	    uinfo->value.integer.min == 0 && uinfo->value.integer.max == 1)
-		goto __unalloc;
+		goto out;
	*left = snd_mixer_oss_conv1(uctl->value.integer.value[0],
uinfo->value.integer.min, uinfo->value.integer.max,
&pslot->volume[0]);
	if (uinfo->count > 1)
		*right = snd_mixer_oss_conv1(uctl->value.integer.value[1],
uinfo->value.integer.min, uinfo->value.integer.max,
&pslot->volume[1]);
-      __unalloc:
+out:
+	kfree(uctl);
+out_uctl:
+	kfree(uinfo);
+out_uinfo:
	up_read(&card->controls_rwsem);
-      	kfree(uctl);
-      	kfree(uinfo);
}

static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer,
@@ -550,13 +554,15 @@ static void snd_mixer_oss_get_volume1_sw
		return;
	}
	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL)
+		goto out_uinfo;
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL)
-		goto __unalloc;
+	if (uctl == NULL)
+		goto out_uctl;
	if (kctl->info(kctl, uinfo))
-		goto __unalloc;
+		goto out;
	if (kctl->get(kctl, uctl))
-		goto __unalloc;
+		goto out;
	if (!uctl->value.integer.value[0]) {
		*left = 0;
		if (uinfo->count == 1)
@@ -564,10 +570,12 @@ static void snd_mixer_oss_get_volume1_sw
	}
	if (uinfo->count > 1 && !uctl->value.integer.value[route ? 3 : 1])
		*right = 0;
-      __unalloc:
-	up_read(&card->controls_rwsem);
-      	kfree(uctl);
+out:
+	kfree(uctl);
+out_uctl:
	kfree(uinfo);
+out_uinfo:
+	up_read(&card->controls_rwsem);
}

static int snd_mixer_oss_get_volume1(struct snd_mixer_oss_file *fmixer,
@@ -613,25 +621,29 @@ static void snd_mixer_oss_put_volume1_vo
	if ((kctl = snd_ctl_find_numid(card, numid)) == NULL)
		return;
	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL)
+		goto out_uinfo;
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL)
-		goto __unalloc;
+	if (uctl == NULL)
+		goto out_uctl;
	if (kctl->info(kctl, uinfo))
-		goto __unalloc;
+		goto out;
	if (uinfo->type == SNDRV_CTL_ELEM_TYPE_BOOLEAN &&
	    uinfo->value.integer.min == 0 && uinfo->value.integer.max == 1)
-		goto __unalloc;
+		goto out;
	uctl->value.integer.value[0] = snd_mixer_oss_conv2(left,
uinfo->value.integer.min, uinfo->value.integer.max);
	if (uinfo->count > 1)
		uctl->value.integer.value[1] = snd_mixer_oss_conv2(right,
uinfo->value.integer.min, uinfo->value.integer.max);
	if ((res = kctl->put(kctl, uctl)) < 0)
-		goto __unalloc;
+		goto out;
	if (res > 0)
		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &kctl->id);
-      __unalloc:
-	up_read(&card->controls_rwsem);
-      	kfree(uctl);
+out:
+	kfree(uctl);
+out_uctl:
	kfree(uinfo);
+out_uinfo:
+	up_read(&card->controls_rwsem);
}

static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
@@ -654,11 +666,13 @@ static void snd_mixer_oss_put_volume1_sw
		return;
	}
	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL)
+		goto out_uinfo;
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL)
-		goto __unalloc;
+	if (uctl == NULL)
+		goto out_uctl;
	if (kctl->info(kctl, uinfo))
-		goto __unalloc;
+		goto out;
	if (uinfo->count > 1) {
		uctl->value.integer.value[0] = left > 0 ? 1 : 0;
		uctl->value.integer.value[route ? 3 : 1] = right > 0 ? 1 : 0;
@@ -670,13 +684,15 @@ static void snd_mixer_oss_put_volume1_sw
		uctl->value.integer.value[0] = (left > 0 || right > 0) ? 1 : 0;
	}
	if ((res = kctl->put(kctl, uctl)) < 0)
-		goto __unalloc;
+		goto out;
	if (res > 0)
		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &kctl->id);
-      __unalloc:
-	up_read(&card->controls_rwsem);
-      	kfree(uctl);
+out:
+	kfree(uctl);
+out_uctl:
	kfree(uinfo);
+out_uinfo:
+	up_read(&card->controls_rwsem);
}

static int snd_mixer_oss_put_volume1(struct snd_mixer_oss_file *fmixer,
@@ -775,21 +791,25 @@ static int snd_mixer_oss_get_recsrc2(str
	int err, idx;
	
	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL){
+		err = -ENOMEM;
+		goto out_uinfo;
+	}
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL) {
+	if (uctl == NULL) {
		err = -ENOMEM;
-		goto __unlock;
+		goto out_uctl;
	}
	down_read(&card->controls_rwsem);
	kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
	if (! kctl) {
		err = -ENOENT;
-		goto __unlock;
+		goto out;
	}
	if ((err = kctl->info(kctl, uinfo)) < 0)
-		goto __unlock;
+		goto out;
	if ((err = kctl->get(kctl, uctl)) < 0)
-		goto __unlock;
+		goto out;
	for (idx = 0; idx < 32; idx++) {
		if (!(mixer->mask_recsrc & (1 << idx)))
			continue;
@@ -805,10 +825,12 @@ static int snd_mixer_oss_get_recsrc2(str
		}
	}
	err = 0;
-      __unlock:
+out:
+	kfree(uctl);
+out_uctl:
+	kfree(uinfo);
+out_uinfo:
     	up_read(&card->controls_rwsem);
-      	kfree(uctl);
-      	kfree(uinfo);
      	return err;
}

@@ -825,19 +847,23 @@ static int snd_mixer_oss_put_recsrc2(str
	unsigned int idx;

	uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+	if (uinfo == NULL){
+		err = -ENOMEM;
+		goto out_uinfo;
+	}
	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
-	if (uinfo == NULL || uctl == NULL) {
+	if (uctl == NULL) {
		err = -ENOMEM;
-		goto __unlock;
+		goto out_uctl;
	}
	down_read(&card->controls_rwsem);
	kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
	if (! kctl) {
		err = -ENOENT;
-		goto __unlock;
+		goto out;
	}
	if ((err = kctl->info(kctl, uinfo)) < 0)
-		goto __unlock;
+		goto out;
	for (idx = 0; idx < 32; idx++) {
		if (!(mixer->mask_recsrc & (1 << idx)))
			continue;
@@ -852,18 +878,20 @@ static int snd_mixer_oss_put_recsrc2(str
		slot = NULL;
	}
	if (! slot)
-		goto __unlock;
+		goto out;
	for (idx = 0; idx < uinfo->count; idx++)
		uctl->value.enumerated.item[idx] = slot->capture_item;
	err = kctl->put(kctl, uctl);
	if (err > 0)
		snd_ctl_notify(fmixer->card, SNDRV_CTL_EVENT_MASK_VALUE, &kctl->id);
	err = 0;
-      __unlock:
-	up_read(&card->controls_rwsem);
+out:
	kfree(uctl);
+out_uctl:
	kfree(uinfo);
-	return err;
+out_uinfo:
+     	up_read(&card->controls_rwsem);
+      	return err;
}

struct snd_mixer_oss_assign_table {


Regards
dave
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [patch -mm] alsa mixer_oss kfree fix
    • From: Andrew Morton <[email protected]>

• Prev by Date: Re: 2.6.22-rc3-mm1 - page_mkwrite() breakage
• Next by Date: Re: 2.6.22-rc3-mm1 - page_mkwrite() breakage
• Previous by thread: Documentation: /proc/$pid/stat files
• Next by thread: Re: [patch -mm] alsa mixer_oss kfree fix
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]